The laravel-openssl-encryption from neoxia

Comparison for HMAC is time sensitive

The HMAC comparison is susceptible to timing attacks. A better implementation of comparison should be used to prevent this information from being leaked.

https://en.wikipedia.org/wiki/Timing_attack

https://github.com/neoxia/laravel-openssl-encryption/blob/master/src/Neoxia/LaravelOpensslEncryption/Encrypter.php#L141

A simple fix would be:

if (! \Symfony\Component\Security\Core\Util\StringUtils::equals($this->hash($payload['value']), $payload['mac'])) {
        throw new DecryptException("MAC for payload is invalid.");
}

Laravel 4.2

I'm getting this error when trying to run "composer update" on laravel 4.2

Problem 1
    - Conclusion: remove laravel/framework v4.2.6
    - Conclusion: don't install laravel/framework v4.2.6
    - Conclusion: don't install laravel/framework v4.2.5
    - Conclusion: don't install laravel/framework v4.2.4
    - Conclusion: don't install laravel/framework v4.2.3
    - Installation request for neoxia/laravel-openssl-encryption 1.0.* -> satisfiable by neoxia/laravel-openssl-encryption[1.0].
    - Conclusion: don't install laravel/framework v4.2.2
    - Conclusion: don't install laravel/framework v4.2.1
    - neoxia/laravel-openssl-encryption 1.0 requires illuminate/encryption 4.0.x -> satisfiable by illuminate/encryption[v4.0.0, v4.0.1, v4.0.10, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9].
    - don't install illuminate/encryption v4.0.0|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.1|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.10|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.2|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.3|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.4|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.5|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.6|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.7|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.8|don't install laravel/framework v4.2.0
    - don't install illuminate/encryption v4.0.9|don't install laravel/framework v4.2.0
    - Installation request for laravel/framework 4.2.* -> satisfiable by laravel/framework[v4.2.0, v4.2.1, v4.2.2, v4.2.3, v4.2.4, v4.2.5, v4.2.6].

and this one when running "composer install"

PHP Fatal error:  Class 'Neoxia\LaravelOpensslEncryption\LaravelOpensslEncryptionServiceProvider' not found in /Users/lucoceano/Documents/Projects/trip-server/google-cloud-sdk/trip/bootstrap/compiled.php on line 4219
{"error":{"type":"Symfony\\Component\\Debug\\Exception\\FatalErrorException","message":"Class 'Neoxia\\LaravelOpensslEncryption\\LaravelOpensslEncryptionServiceProvider' not found","file":"\/Users\/lucoceano\/Documents\/Projects\/trip-server\/google-cloud-sdk\/trip\/bootstrap\/compiled.php","line":4219}}Script php artisan clear-compiled handling the post-install-cmd event returned with an error



  [RuntimeException]                                                                                                                                                         
  Error Output: PHP Fatal error:  Class 'Neoxia\LaravelOpensslEncryption\LaravelOpensslEncryptionServiceProvider' not found in /Users/lucoceano/Documents/Projects/trip-ser  
  ver/google-cloud-sdk/trip/bootstrap/compiled.php on line 4219

is there any issue because I'm using laravel 4.2?

thanks

HMAC should represent the integrity of the whole value

HMAC is currently missing the IV to help prevent modification of the IV.

https://github.com/neoxia/laravel-openssl-encryption/blob/master/src/Neoxia/LaravelOpensslEncryption/Encrypter.php#L155

A signature like this would be preferable:

protected function hash($iv, $value)
{
	return hash_hmac('sha256', $iv.$value, $this->key);
}

neoxia / laravel-openssl-encryption Goto Github PK

laravel-openssl-encryption's People

Contributors

Stargazers

Watchers

Forkers

laravel-openssl-encryption's Issues

Comparison for HMAC is time sensitive

Laravel 4.2

HMAC should represent the integrity of the whole value

Hi, can this be used for laravel 4.1 ?

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent